vpn.ctau.cloud - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 49.255.115.170, located in Melbourne, Australia and belongs to VOCUS-BACKBONE-AS Vocus Connect International Backbone, AU. The main domain is vpn.ctau.cloud.
TLS certificate: Issued by ZeroSSL ECC Domain Secure Site CA on March 9th 2023. Valid for: 3 months.

This is the only time vpn.ctau.cloud was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	49.255.115.170 49.255.115.170	4826 (VOCUS-BAC...) (VOCUS-BACKBONE-AS Vocus Connect International Backbone)
1	199.167.52.5 199.167.52.5	54538 (PAN0001) (PAN0001)
3	2

2 49.255.115.170 (Melbourne, Australia)

ASN4826 (VOCUS-BACKBONE-AS Vocus Connect International Backbone, AU)
PTR: static-170.115.255.49.in-addr.VOCUS.net.au

vpn.ctau.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.167.52.5 (San Jose, United States)

ASN54538 (PAN0001, US)

gp.paloaltonetworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	ctau.cloud vpn.ctau.cloud	8 KB
1	paloaltonetworks.com gp.paloaltonetworks.com
3	2

	Domain	Requested by
2	vpn.ctau.cloud	vpn.ctau.cloud
1	gp.paloaltonetworks.com	vpn.ctau.cloud
3	2

This site contains no links.

Subject Issuer	Validity	Valid
vpn.ctau.cloud ZeroSSL ECC Domain Secure Site CA	`2023-03-09` - `2023-06-07`	3 months	crt.sh
*.paloaltonetworks.com Go Daddy Secure Certificate Authority - G2	`2022-10-17` - `2023-11-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://vpn.ctau.cloud/global-protect/login.esp
Frame ID: 5480D017C7B23CBB6F97B97F5F440478
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

GlobalProtect Portal

Page URL History Show full URLs

https://vpn.ctau.cloud/ Page URL
https://vpn.ctau.cloud/global-protect/login.esp Page URL

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

8 kB
Transfer

7 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://vpn.ctau.cloud/ Page URL
https://vpn.ctau.cloud/global-protect/login.esp Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
vpn.ctau.cloud/ 170 B
480 B 492ms
111ms Document
text/html 49.255.115.170
VOCUS-BACKBONE-AS...

General

Check archive.org

Show headers Download Go to

Full URL: https://vpn.ctau.cloud/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 49.255.115.170 Melbourne, Australia, ASN4826 (VOCUS-BACKBONE-AS Vocus Connect International Backbone, AU),
Reverse DNS: static-170.115.255.49.in-addr.VOCUS.net.au
Software: PanWeb Server/ - /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: private, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 170
Content-Type: text/html
Date: Thu, 09 Mar 2023 12:09:02 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Keep-Alive: timeout=30, max=19
Pragma: private
Server: PanWeb Server/ -

GET
H/1.1 200
OK Primary Request login.esp Show response
vpn.ctau.cloud/global-protect/ 7 KB
8 KB 128ms
128ms Document
text/html 49.255.115.170
VOCUS-BACKBONE-AS...

General

Check archive.org

Show headers Download Go to

Full URL

https://vpn.ctau.cloud/global-protect/login.esp

Requested by

Host: vpn.ctau.cloud
URL: https://vpn.ctau.cloud/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

49.255.115.170 Melbourne, Australia, ASN4826 (VOCUS-BACKBONE-AS Vocus Connect International Backbone, AU),

Reverse DNS

static-170.115.255.49.in-addr.VOCUS.net.au

Software

PanWeb Server/ - /

Resource Hash

7ad98ce0aa9d4ae3e5481926cd5d9c80cbd0f316e425c5aa8032f8de0cf1f37e

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

Referer: https://vpn.ctau.cloud/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 7282
Content-Type: text/html; charset=UTF-8
Date: Thu, 09 Mar 2023 12:09:02 GMT
ETag: "1eea2-2a78-566b9d45"
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=30, max=18
Pragma: no-cache
Server: PanWeb Server/ -
X-FRAME-OPTIONS: DENY

GET
H/1.1 404
Not Found logo_pan_158.gif
gp.paloaltonetworks.com/images/ 0
0 1550ms
257ms Image
text/html 199.167.52.5
PAN0001

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gp.paloaltonetworks.com/images/logo_pan_158.gif
Requested by: Host: vpn.ctau.cloud
URL: https://vpn.ctau.cloud/global-protect/login.esp
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 199.167.52.5 San Jose, United States, ASN54538 (PAN0001, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://vpn.ctau.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| loadPage function| submitClicked function| checkCapsLock

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			vpn.ctau.cloud/global-protect	1969-12-31 23:59:59	Name: PHPSESSID Value: adc3806a251c933ad03e54396b873fa3

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://gp.paloaltonetworks.com/images/logo_pan_158.gif Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gp.paloaltonetworks.com
vpn.ctau.cloud
199.167.52.5
49.255.115.170
7ad98ce0aa9d4ae3e5481926cd5d9c80cbd0f316e425c5aa8032f8de0cf1f37e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

vpn.ctau.cloud Open in urlscan Pro 49.255.115.170 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

3 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

8 kBTransfer

7 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

vpn.ctau.cloud Open in urlscan Pro
49.255.115.170 Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

8 kB
Transfer

7 kB
Size

1
Cookies

3 HTTP transactions
0 data transactions